Loan app harassment in India — stop abuse and complain in 2026

Loan repayment does not authorise threats, public shaming, impersonation, misuse of contacts or publication of morphed images. Do not pay an unknown personal UPI ID merely because a caller threatens you. Preserve evidence, identify the actual regulated lender, secure your phone and payment accounts, complain to that lender, and use cybercrime or police channels immediately where there is fraud, extortion, threats or intimate-image abuse.

Two questions must be handled independently:

1. What amount, if any, is lawfully due under the loan contract? Ask for the Key Fact Statement, sanction letter, account statement, APR, charges and repayment destination.
2. Is the collection conduct lawful? Threats, impersonation, doxxing, contact-list shaming, obscene messages and unauthorised access can require regulatory and criminal complaints even where a genuine balance exists.

Do not claim that harassment automatically cancels a genuine loan. Equally, do not accept abuse as a lawful collection method.

Save evidence in a folder that the loan app cannot access:

• screenshots showing number, date, time and full message;
• exported chats, voice notes, call logs and voicemails;
• screen recording of the app profile, permissions and repayment demand;
• app-store URL, developer name, package identifier and version;
• Key Fact Statement, loan agreement and sanction email;
• bank statement showing the account that disbursed the money;
• every payment receipt and UTR/reference number;
• names or numbers of relatives or colleagues contacted; and
• the exact threat, false claim or image circulated.

Ask affected contacts to preserve their own original messages. Do not forward abusive images widely; retain them securely for the complaint.

Review the app's permissions in phone settings. Revoke access that is unnecessary, especially contacts, storage/media, microphone, camera, SMS and location. Remove unknown device-administrator, accessibility, screen-sharing or configuration permissions. Update the phone, run its built-in security scan and change banking, email and social passwords from a trusted device if compromise is suspected.

Uninstall only after preserving evidence and identifying the lender. Uninstallation does not erase copied data or end a genuine loan.

Pay only through the lender's verified official channel and into the account specified by the regulated entity. A caller's personal UPI ID, QR code or newly messaged account is a fraud warning. Confirm any changed repayment route through contact details independently obtained from the lender's official website.

A loan app may be only a Digital Lending App (DLA) or a Lending Service Provider (LSP) working for a bank or NBFC. RBI regulates the bank or NBFC, not every app simply because it appears in an app store.

Check:

1. the regulated entity named in the Key Fact Statement and loan agreement;
2. the sender name and bank account behind the disbursal;
3. whether the lender appears in RBI's regulated-entity information;
4. whether the regulated entity's own website lists the app or LSP; and
5. the grievance officer details displayed by the app and lender.

An app using an RBI logo or saying “RBI approved” is not proof. RBI's 2026 public information explains that its directory helps citizens check associations reported by regulated entities; it does not transform every listed app into an RBI-guaranteed product.

RBI now places digital-lending rules in entity-specific Credit Facilities Directions. The current commercial-bank and NBFC directions contain the core protections below and make the regulated lender responsible for its LSP arrangements. Use RBI's Master Directions directory to select the lender category before quoting a rule.

• a Key Fact Statement before execution, including the annual percentage rate and essential loan terms;
• digitally signed loan documents sent to the borrower;
• disbursal and repayment flows controlled under the Direction rather than an opaque pass-through account, subject to stated exceptions;
• an exit option during the disclosed cooling-off period on the terms in the Direction;
• collection of data only for a lawful, need-based purpose with consent and a privacy policy;
• restrictions on accessing phone resources such as contact lists, call logs and telephony functions;
• grievance officers of the regulated entity and LSP/DLA; and
• prior communication of the authorised recovery agent's particulars before that agent contacts the borrower.

Consent is not a blank cheque to shame contacts. Ask the lender to disclose what data was collected, the purpose, recipient, retention policy and deletion options available under the Direction and applicable law.

Document conduct such as:

Do not threaten the caller back, publish their personal information, or install a “refund recovery” app offered by another stranger.

Send a single indexed complaint. State the loan account, disputed amount, caller identifiers, conduct, dates, evidence list and relief sought. Ask the lender to:

• confirm whether the caller/agency is authorised;
• stop unlawful contact and contact-list use;
• give a complete account statement and calculation;
• provide the KFS, agreement, recovery-agent authority and grievance decision;
• preserve call, assignment, consent and data-access logs; and
• correct any unsupported credit reporting after investigation.

Keep the acknowledgement or ticket. A payment dispute should identify which line item is disputed rather than merely stating “all charges illegal”.

The Reserve Bank — Integrated Ombudsman Scheme, 2026 applies from 1 July 2026. First complain to the bank or NBFC. If its response is rejected or unsatisfactory, or no response arrives within the applicable Scheme period, check eligibility and submit at cms.rbi.org.in. Filing is free.

RBI CMS is not the route for an unidentified criminal app with no regulated entity. It also does not replace an urgent police report.

Use cybercrime.gov.in for cyber offences and 1930 for recent cyber financial fraud. Report credible threats, extortion, impersonation, stalking, obscene or intimate-image abuse, forgery and unauthorised account access to police with the evidence index.

Do not wait for the lender's internal grievance process where immediate safety or fast-moving fraud is involved.

A consumer complaint may be relevant to proven service deficiency or unfair practice. A lawyer can advise on an injunction, criminal complaint, debt dispute or privacy remedy where harm is serious. Use the consumer-rights guide to distinguish pre-litigation help from adjudication.

Subject: Urgent recovery-conduct and data-misuse complaint — loan [ID]

I received the attached calls/messages from [number/account] on [dates]. The
sender claimed to act for [lender/app] and [state exact conduct]. Please confirm
whether this person is authorised, stop abusive or third-party contact, preserve
all assignment/call/consent/data-access records, and provide my KFS, agreement,
complete account statement and reasoned grievance decision. I remain willing
to communicate about any verified lawful balance through your official channel.

Send facts, not insults. Redact Aadhaar, card and bank credentials from public-facing attachments.

Check your reports from the relevant credit information companies through their official channels. If the loan is unknown or an amount is wrong, dispute it with both the lender and the credit information company and preserve their reference numbers.

Do not take a fresh high-cost app loan merely to silence the first collector. If repayment difficulty is genuine, ask the lender in writing about available restructuring or hardship options. There is no universal right to settlement, waiver or a particular instalment reduction.

RTI can seek records held by RBI, police or another public authority, subject to exemptions: action on a complaint, file movement, applicable circulars or status. It cannot order a private lender to waive debt, investigate your phone or compensate you.

Use the AI RTI Drafter only after identifying the public authority and exact records. Keep it separate from the lender grievance and criminal report.

• Paying a newly supplied personal UPI ID under threat.
• Deleting the app and chats before preserving evidence.
• Assuming an app-store listing means RBI approval.
• Publicly posting unredacted KYC or intimate material.
• Disputing abuse but never requesting the actual account statement.
• Claiming harassment automatically cancels a genuine debt.
• Using RBI CMS before first complaining to the regulated entity.
• Waiting for a grievance reply despite an immediate threat or cyber fraud.

RBI's current commercial-bank and NBFC credit-facilities directions restrict covered digital lenders' data access and use. Preserve proof and complain to the regulated lender; report threats or unlawful publication separately.

Preserve full evidence first. You may then block abusive numbers, while keeping one written official channel open with the verified lender.

No. Liability under a genuine contract and unlawful collection conduct are separate issues.

Treat it as a warning sign. Verify the repayment destination independently with the lender and report suspected fraud promptly.

Tell the lender's fraud team, secure accounts, check credit reports and make a cybercrime or police report with identity-misuse evidence.

No. It covers eligible complaints against regulated entities under the current Scheme after the entity-level complaint step.

Ask for the privacy policy, collected-data inventory, purpose, recipients and available deletion controls. Some records may have lawful retention duties.

Use a written verified channel. If you discuss repayment, request the complete calculation and written terms before paying.

• RBI — Commercial Banks Credit Facilities Directions, updated July 2026
• RBI — NBFC Credit Facilities Directions, updated July 2026
• RBI — current Master Directions directory
• PIB — Government measures against illegal digital lending apps, July 2026
• RBI — Integrated Ombudsman Scheme, 2026 FAQ
• RBI — Integrated Ombudsman Scheme, 2026
• RBI Complaint Management System
• Ministry of Home Affairs — National Cyber Crime Reporting Portal

Last reviewed: 1 September 2026.